Skip to content

Commit

Permalink
Statement: Find all unknown Actions and unknown Prefixes in a Statement
Browse files Browse the repository at this point in the history
The primary use case of this change is for faster developer feedback.
If there are two typo'd Actions in a single IAM Statement, parliament
will only catch one; the user then makes a fix and then re-runs
parliament to find the second issue. If there is a serious Exception
with the Action syntax, we should still bail out and return False.
However, UnknownAction and UnknownPrefix are recoverable and parliament
should attempt to find all of them.
  • Loading branch information
raghavkaul committed Dec 7, 2020
1 parent 66c6588 commit bf52cc5
Showing 1 changed file with 11 additions and 3 deletions.
14 changes: 11 additions & 3 deletions parliament/statement.py
Original file line number Diff line number Diff line change
Expand Up @@ -773,6 +773,7 @@ def analyze_statement(self):

# Expand the actions from s3:Get* to s3:GetObject and others
expanded_actions = []
has_malformed_action = False
for action in actions:

# Handle special case where all actions are allowed
Expand All @@ -785,16 +786,23 @@ def analyze_statement(self):
expanded_actions.extend(expand_action(action.value))
except UnknownActionException as e:
self.add_finding(
"UNKNOWN_ACTION", detail=str(e), location=action,
"UNKNOWN_ACTION",
detail=str(e),
location=action,
)
return False
has_malformed_action = True
continue
except UnknownPrefixException as e:
self.add_finding("UNKNOWN_PREFIX", detail=str(e), location=action)
return False
has_malformed_action = True
continue
except Exception as e:
self.add_finding("EXCEPTION", detail=str(e), location=action)
return False

if has_malformed_action:
return False

# Check the resources are correct formatted correctly
has_malformed_resource = False
for resource in resources:
Expand Down

0 comments on commit bf52cc5

Please sign in to comment.